CVE-2023-2904 CVE-2023-2904
An attacker can manipulate visitor IDs to access other users' personal data and cause denial of service in the HID SAFE External Visitor Manager portal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-2904?
CVE-2023-2904 is a high-severity missing authorization vulnerability in HID Global SAFE, published on 7 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.
Weakness: CWE-471
Which versions are affected by CVE-2023-2904?
It affects 1 product.
Products include Hidglobal Safe.
How do I fix CVE-2023-2904?
No fix has been published for CVE-2023-2904 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-2904 being exploited?
There is no known exploitation of CVE-2023-2904 in the wild and no public exploit code.
Sources
Also known as GHSA-r5vr-5hvg-2xcg.